---
title: "OAuth token endpoint"
method: POST
path: "/oauth/2026-03/token"
tags: ["Advanced"]
---

# OAuth token endpoint

`POST /oauth/2026-03/token`

## Request

- Base URL: `https://api.hubapi.com`
- URL: `https://api.hubapi.com/oauth/2026-03/token`
- Auth: none declared

Authenticates a client and returns access and refresh tokens.

## Request body `application/x-www-form-urlencoded`

- object
  - `assertion` string
  - `client_assertion` string
  - `client_assertion_type` string
  - `client_id` string
  - `client_secret` string
  - `code` string
  - `code_verifier` string
  - `grant_type` 'authorization_code' | 'client_credentials' | 'refresh_token' | 'urn:ietf:params:oauth:grant-type:jwt-bearer'
  - `redirect_uri` string
  - `refresh_token` string
  - `scope` string

## Response `200`

successful operation

- union
  - object
    - `access_token` string, required: A string representing the access token that allows access to the API.
    - `expires_in` integer, required: An integer in int64 format indicating the duration in seconds until the access token expires.
    - `hub_id` integer: An integer representing the unique identifier of the HubSpot account (hub) associated with the token.
    - `id_token` string: A string representing the ID token, which is an optional part of the response.
    - `refresh_token` string, required: A string representing the refresh token, which can be used to obtain a new access token.
    - `scopes` string[]: An array of strings specifying the scopes that are granted with the access token.
    - `token_type` string, required: A string indicating the type of token issued.
    - `token_use` 'access_token', required: Indicates the usage of the token, which is 'access_token' by default. It is a string with a fixed value of 'access_token'.
    - `user_id` integer: An integer representing the unique identifier of the user associated with the token.
  - object
    - `access_token` string, required: A string representing the access token issued.
    - `expires_in` integer, required: An integer indicating the number of seconds until the token expires, in int64 format.
    - `hub_id` integer: An integer representing the HubSpot account ID associated with the token.
    - `id_token` string: A string representing the ID token, if applicable.
    - `scopes` string[]: An array of strings representing the scopes granted by the token.
    - `token_type` string, required: A string indicating the type of the token.
    - `token_use` 'client_credentials', required: Indicates the usage of the token, which is 'client_credentials' by default.
    - `user_id` integer: An integer representing the user ID associated with the token.

## Other responses

- `default`: An error occurred.

## Changes

- **2026-10-02** (2026-03) `4dd5ff826efe`: 2 info
  - added the new optional request property `assertion`
  - added the new `urn:ietf:params:oauth:grant-type:jwt-bearer` enum value to the request property `grant_type`
- **2026-08-19** (2026-03) `8eb04f565f43`: 2 info
  - added the new optional request property `client_assertion`
  - added the new optional request property `client_assertion_type`
- **2026-06-15** (2026-03) `03dfd4737244`: 2 breaking, 7 warning, 1 info
  - added `#/components/schemas/AccessTokenResponse, #/components/schemas/ClientCredentialsTokenResponse` to the response body `oneOf` list for the response status `200`
  - the response's body type changed from `object` to no type for status `200`
  - removed the optional property `accessToken` from the response with the `200` status
  - removed the optional property `expiresIn` from the response with the `200` status
  - …6 more
- **2026-06-15** (2026-03) `33cdb28eb03d`: 1 breaking, 9 info
  - the response's body type changed from no type to `object` for status `200`
  - added response discriminator for the response status `200`
  - removed `#/components/schemas/AccessTokenResponse, #/components/schemas/ClientCredentialsTokenResponse` from the response body `oneOf` list for the response status `200`
  - added the optional property `accessToken` to the response with the `200` status
  - …6 more
- …earlier changes not shown

[Operation history](https://skmtc.dev/hubspot/apis/auth-oauth/changes/oauth/2026-03/token/post.md)

---

[API](https://skmtc.dev/hubspot/apis/auth-oauth.md) - [All operations](https://skmtc.dev/hubspot/apis/auth-oauth/llms.txt) - [OpenAPI document](https://skmtc.dev/hubspot/apis/auth-oauth/revisions/976a8e400266?raw)